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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )E3 Responsive to communication(s) filed on 30 July 2007 . 
2a)D This action is FINAL. 2b)£<] This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) [X] Claim(s) 1-37 is/are pending in the application. 

4a) Of the above claim(s) 38-47 is/are withdrawn from consideration. 

5) Q Claim(s) is/are allowed. 

6) S Claim(s) 1-37 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) E3 The specification is objected to by the Examiner. 

10)[3 The drawing(s) filed on 07 November 2001 is/are: a)E3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1. Q Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1. This action is responsive to the communication filed on July 30, 2007. 

Claims 38-47 have been withdrawn from further consideration pursuant to 37 
CFR 1.142(b), as being drawn to a nonelected species, there being no allowable 
generic or linking claim. Claims 1-37 are now pending. 



2. The applicant should always use the period for response to thoroughly 

and very closely proof read and review the whole of the application for correct 
correlation between reference numerals in the textual portion of the Specification 
and Drawings along with any minor spelling errors, general typographical errors, 
accuracy, assurance of proper use for Trademarks ™, and other legal symbols 
®, where required, and clarity of meaning in the Specification, Drawings, and 
specifically the claims (i.e., provide proper antecedent basis for "the" and "said" 
within each claim). Minor typographical errors could render a Patent 
unenforceable and so the applicant is strongly encouraged to aid in this 
endeavor. 



Specification 

3. The disclosure is objected to because it contains an embedded hyperlink 

and/or other form of browser-executable code. Applicant is required to delete the 
embedded hyperlink and/or other form of browser-executable code. See MPEP § 
608.01. 
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Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this 
Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the 
United States before the invention thereof by the applicant for patent, or on an international application 
by another who has fulfilled the requirements of paragraphs (1), (2), and (4) of section 371(c) of this 
title before the invention thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors 
Protection Act of 1999 (AIPA) and the Intellectual Property and High Technology 
Technical Amendments Act of 2002 do not apply when the reference is a U.S. 
patent resulting directly or indirectly from an international application filed before 
November 29, 2000. Therefore, the prior art date of the reference is determined 
under 35 U.S.C. 102(e) prior to the amendment by the AIPA (pre-AlPA 35 U.S.C. 
102(e)). 



4. Claims 1-37 are rejected under 35 U.S.C. 102(e) as being anticipated by 

O'Flaherty et al. (U.S. Patent Number 6,275,824) hereinafter referred as 
O'Flaherty. 



O'Flaherty teaches the invention as claimed including a method for 
managing data privacy in a database management system. Storing and retrieving 
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data from a plurality of database tables wherein the data in the database tables is 
controllably accessible according to privacy parameters store din the database 
table (See abstract). 

As to claim 1, O'Flaherty teaches A system to enforce privacy preferences 
on exchanges of personal data comprising of one or more computers connected 
to one or more networks through one or more network interfaces, each computer 
having one or more memories and one or more central processing units (CPUs), 
the system further comprising: 

one or more data-subject rule sets that has one or more subject 
constraints on one or more private, subject data releases (abstract) ; 

a receiving process that receives a request message from a data- 
requester over the network interfaces, the request message having one or more 
requests for one or more of the private, subject data releases pertaining to a 
subject, and a requester privacy statement for each of the respective private data 
(abstract, Column 4, lines 30-Column 5, lines 63); and 

a release process that compares the requester privacy statement to the 
subject constraints and releases the private, subject data release in a response 
message to the requester only if the subject constraints are satisfied (abstract, 
Column 4, lines 30-Column 5, lines 63). 
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As to claim 2, O'Flaherty teaches a system, as in claim 1 , where the 
requester also has to be authorized to receive the private data (Column 4, lines 
49-Column 5, lines 16). 

As to claim 3, O'Flaherty teaches a system, as in claim 2, where there is 
more than one level of authorization (Column 4, lines 49-Column 5, lines 16). 

As to claim 4, O'Flaherty teaches a system, as in claim 1, wherein each of 
the subject constraints further comprises: 

an authorization dataset describing the data to which the constraint 
applies (Column 1, lines 28-Column 2, lines 20; Column 2, lines 57-Column 3, 
lines 21); 

a privacy preference rule that describes the privacy preferences under 
which the data may be released and the corresponding actions allowed (Column 
1, lines 28-Column 2, lines 20; Column 2, lines 57-Column 3, lines 21); 

an access list describing who is allowed to access the data (Column 1, 
lines 28-Column 2, lines 20; Column 2, lines 57-Column 3, lines 21); and 

an authorization action that describes any additional action to be taken if 
the restrictions imposed by the authorization dataset, the privacy preference rule 
and the access list of this constraint are matched (Column 1, lines 28-Column 2, 
lines 20; Column 2, lines 57-Column 3, lines 21). 
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As to claim 5, O'Flaherty teaches a system, as in claim 1 , wherein the 
private, subject data release further comprises: 

one or more subject data that is owned and held by the data-subject 
(Column 2, lines 57-Column 3, lines 21); 

one or more subject data that is owned by the data-subject, but held by 
one or more parties on behalf of the data subject (Column 2, lines 57-Column 3, 
lines 21); and 

one or more subject data that is owned and held by one or more third 
parties (Column 2, lines 57-Column 3, lines 21). 

As to claim 6, O'Flaherty teaches a system, as in claim 1, where one or 
more of the requesters have to satisfy different subject rule sets for the same 
private data (Column 4, lines 30-Column 5, lines 63). 

As to claim 7, O'Flaherty teaches a system, as in claim 1, where the 
private, subject data release is partitioned into a first part that satisfies the 
constraints and is released and a second part that does not satisfy the 
constraints and is not released (Column 4, lines 30-Column 5, lines 63). 

As to claim 8, O'Flaherty teaches a system, as in claim 1 , wherein the 
private, subject data released further comprises one or more data for which 
additional manual authorization from the subject is needed before the data is 
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released (Column 4, lines 30-Column 5, lines 63). 

As to claim 9, O'Flaherty teaches a system, as in claim 1 , wherein the 
private, subject data released further comprises one or more missing values 
which have to be acquired from the subject before the data is released (Column 
4, lines 30-Column 5, lines 63). 

As to claim 10, O'Flaherty teaches a system, as in claim 1, wherein 
private, subject data released further comprises one or more data that is stored 
with one or more third parties and has to be retrieved from the third parties 
before the private, subject data release can be released (Column 5, lines 64- 
Column 6, lines 12). 

As to claim 11, O'Flaherty teaches a system, as in claim 1, wherein the 
private, subject data released further comprises one or ore data that is stored 
with one or more third parties and the third parties have to be provided with 
authorization to release the data to the requester (Column 5, lines 64-Column 6, 
lines 12). 

As to claim 12, O'Flaherty teaches a system, as in claim 1, where the 
private, subject data release to which each constraint applies comprises one or 
more of the following: 
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one or more classes of data, one or more properties of data, and one or 
more instances of data (abstract). 

As to claim 13, O'Flaherty teaches a system, as in claim 1, where the 
private, subject data release is ordered in a hierarchy with one or more levels 
and each of the levels has one or more constraints that apply to the respective 
private, subject data release in the level (abstract, Column 2, lines 57-Column 3, 
lines 21). 

As to claim 14, O'Flaherty teaches a system, as in claim 13, where one or 
more of the levels have different constraints (abstract, Column 4, lines 30- 
Column 5, lines 63). 

As to claim 15, O'Flaherty teaches a system, as in claim 13, where one or 
more of the levels inherits one or more of the constraints from one or more other 
levels (abstract, Column 4, lines 30-Column 5, lines 63). 

As to claim 16, O'Flaherty teaches a system, as in claim 13, where the 
level to which each constraint applies further comprises one or more of the 
following: 
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one or more classes of data, one or more properties of data, and one or 
more instances of data (abstract, Column 4, lines 30-Column 5, lines 63). 



As to claim 17, O'Flaherty teaches a system, as in claim 1, where the 
constraints include privacy preferences based on any one or more of the 
Platform for Privacy Preferences (P3P) standard privacy statements, including a 
purpose, a retention, a recipient and an access (abstract, Column 4, lines 30- 
Column 5, lines 63). 



As to claim 18, O'Flaherty teaches a system, as in claim 1 , where the data 
includes any one or more of the following: 

a privacy data, a privacy data associated with a natural person, a 
confidential information, and a trade secret (abstract, Column 1, lines 28-Column 
2, lines 20). 

Claims 19-37 do not teach or define any new limitations other than above 
claims 1-18. Therefore, rejected for similar reasons. 

5. Examiner's Note: Examiner has cited particular columns and line 

numbers in the references as applied to the claims above for the convenience of 
the applicant. Although the specified citations are representative of the teachings 
of the art and are applied to the specific limitations within the individual claim, 
other passages and figures may apply as well. It is respectfully requested from 
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the applicant in preparing responses, to fully consider the references in its 
entirety as potentially teaching of all or part of the claimed invention, as well as 
the context. 



Conclusion 

6. The prior art made of record and not relied upon is considered pertinent to 

applicant's disclosure. 

• Walter (Pub. No. US 2002/0087472) discloses data privacy encoding for 
consumer input media. 

• O'Flaherty et al. (U.S. Patent Number 6,253,203) discloses privacy-enhanced 
database. 

• Veldhuisen (U.S. Patent Number 6,480,850) discloses managing data privacy in 
a database management system. 

• Hagan et al. (U.S. Pub. No. 2001/0054155) discloses privacy and security 
method for world-wide web site. 

• Clayton et al. (U.S. Pub. No. 2002/0010784) discloses policy notice method and 
system. 

• Davis et al. (U.S. Pub. No. 2002/0029254) discloses Method and system for 
managing personal information. 

• Ferreira et al. (U.S. Pub. No. 2002/0091741) discloses method for removing 
personal data from an electronic document. 
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7. 



Any inquiry concerning this communication or earlier communications from 



the examiner should be directed to Faruk Hamza whose telephone number is 
571-272-7969. The examiner can normally be reached on Monday through 
Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Saleh Najjar can be reached at 571-272-4006. The fax 
phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for unpublished applications is available through Private PAIR only. For more 
information about the PAIR system, see http://pair-direct.uspto.gov . Should you 
have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 886-217-9197 (toll -free). 
Faruk Hamza 
Patent Examiner 
Group Art Unite 2155 




THU HA NGUYEN 
PRIMARY EXAMINER 



